Introduction
This document provides sample code for generating pre-signed object links.
For instructions on uploading with a pre-signed URL, see Pre-signed Authorization Upload. For instructions on downloading with a pre-signed URL, see Pre-signed Authorization Download.
Must-Knows
Buckets created after January 1, 2024 do not support previewing files in a browser using the default domain name. We recommend that you configure a custom domain name. For details, see Switching to a Custom Domain Name for a Bucket.
We recommend that users generate pre-signed URLs using temporary credentials to enhance the security of pre-signed upload, download, and other requests through temporary authorization. When you apply for temporary credentials, follow the principle of least privilege to prevent the exposure of resources beyond the target bucket or object.
If you must use permanent credentials to generate a pre-signed URL, we recommend that the permissions scope of the permanent credentials be limited to upload or download operations only to mitigate risks.
For information on obtaining temporary credentials, see the Temporary Key Generation and Usage Guide.
Related Examples
Feature Name | Description | Example code |
Generate Pre-signed URL | COS (Cloud Object Storage) supports uploading and downloading objects using presigned URLs. The principle is to embed the signature into the URL to generate a signed link. |
Prerequisites: Initializing a COS Service Instance
public class DownloadObject { private CosXml cosXml; // Sets the service user as a data member // Initializes the COS service instance private void InitCosXml() { string region = Environment.GetEnvironmentVariable("COS_REGION"); CosXmlConfig config = new CosXmlConfig.Builder() .SetRegion(region) // Sets the default region. For COS region abbreviations, refer to https://cloud.tencent.com/document/product/436/6224 .Build(); string secretId = Environment.GetEnvironmentVariable("SECRET_ID"); // TencentCloud API key SecretId. To obtain API keys, refer to https://console.cloud.tencent.com/cam/capi string secretKey = Environment.GetEnvironmentVariable("SECRET_KEY"); // TencentCloud API key SecretKey. To obtain API keys, refer to https://console.cloud.tencent.com/cam/capi long durationSecond = 600; // Signature validity period for each request, in seconds QCloudCredentialProvider qCloudCredentialProvider = new DefaultQCloudCredentialProvider(secretId, secretKey, durationSecond); this.cosXml = new CosXmlServer(config, qCloudCredentialProvider); } }
Use Case
Generating a Pre-signed URL
public void GetPreSignDownloadUrl() { try { PreSignatureStruct preSignatureStruct = new PreSignatureStruct(); preSignatureStruct.appid = appId;//"1250000000"; //Tencent Cloud account APPID preSignatureStruct.region = region;//"COS_REGION"; //Bucket region preSignatureStruct.bucket = bucket;// "examplebucket-1250000000"; //Bucket preSignatureStruct.key = "exampleObject"; //Object key preSignatureStruct.httpMethod = "GET"; //HTTP request method preSignatureStruct.isHttps = true; //Generates an HTTPS request URL preSignatureStruct.signDurationSecond = 600; //Request signature validity period is 600 seconds preSignatureStruct.headers = null; //Headers to be validated in the signature preSignatureStruct.queryParameters = null; //Query parameters in the URL to be validated in the signature string requestSignURL = cosXml.GenerateSignURL(preSignatureStruct); Console.WriteLine(requestSignURL); //Downloads the request pre-signed URL (signature URL calculated using permanent key method) string localDir = System.IO.Path.GetTempPath(); //Local directory string localFileName = "my-local-temp-file"; //Specifies the local filename to save GetObjectRequest request = new GetObjectRequest(null, null, localDir, localFileName); //Sets the download request pre-signed URL request.RequestURLWithSign = requestSignURL; //Sets the progress callback request.SetCosProgressCallback(delegate(long completed, long total) { Console.WriteLine(String.Format("progress = {0:##.##}%", completed * 100.0 / total)); }); //Executes the request GetObjectResult result = cosXml.GetObject(request); //Request succeeded Console.WriteLine(result.GetResultInfo()); } catch (COSXML.CosException.CosClientException clientEx) { Console.WriteLine("CosClientException: " + clientEx); } catch (COSXML.CosException.CosServerException serverEx) { Console.WriteLine("CosServerException: " + serverEx.GetInfo()); } }
Generating a Pre-signed Upload URL
public void GetPreSignUploadUrl() { try { PreSignatureStruct preSignatureStruct = new PreSignatureStruct(); // For APPID, refer to https://console.cloud.tencent.com/developer preSignatureStruct.appid = appId;//"1250000000"; // Bucket region. For COS region abbreviations, refer to https://cloud.tencent.com/document/product/436/6224 preSignatureStruct.region = region;//"COS_REGION"; // Bucket name. The format must be bucketname-APPID. For APPID, refer to https://console.cloud.tencent.com/developer preSignatureStruct.bucket = bucket;//"examplebucket-1250000000"; preSignatureStruct.key = "exampleObject"; //Object key preSignatureStruct.httpMethod = "PUT"; //HTTP request method preSignatureStruct.isHttps = true; //Generates an HTTPS request URL preSignatureStruct.signDurationSecond = 600; //Request signature validity period is 600 seconds preSignatureStruct.headers = null; //Headers to be validated in the signature preSignatureStruct.queryParameters = null; //Query parameters in the URL to be validated in the signature //Upload pre-signed URL (signature URL calculated using permanent key method) string requestSignURL = cosXml.GenerateSignURL(preSignatureStruct); Console.WriteLine(requestSignURL); string srcPath = @"local-file-path"; //Absolute path of the local file PutObjectRequest request = new PutObjectRequest(null, null, srcPath); //Sets the upload request pre-signed URL request.RequestURLWithSign = requestSignURL; //Sets the progress callback request.SetCosProgressCallback(delegate(long completed, long total) { Console.WriteLine(String.Format("progress = {0:##.##}%", completed * 100.0 / total)); }); //Executes the request PutObjectResult result = cosXml.PutObject(request); //Request succeeded Console.WriteLine(result.GetResultInfo()); } catch (COSXML.CosException.CosClientException clientEx) { Console.WriteLine("CosClientException: " + clientEx); } catch (COSXML.CosException.CosServerException serverEx) { Console.WriteLine("CosServerException: " + serverEx.GetInfo()); } }
Generating a Pre-signed URL with Host in the Signature
public void GetPreSignUrlWithHost() { try { PreSignatureStruct preSignatureStruct = new PreSignatureStruct(); // For APPID, refer to https://console.cloud.tencent.com/developer preSignatureStruct.appid = "1250000000"; // Bucket region. For COS region abbreviations, refer to https://cloud.tencent.com/document/product/436/6224 preSignatureStruct.region = "COS_REGION"; // Bucket name. The format must be bucketname-APPID. For APPID, refer to https://console.cloud.tencent.com/developer preSignatureStruct.bucket = "examplebucket-1250000000"; preSignatureStruct.key = "exampleobject"; //Object key preSignatureStruct.httpMethod = "GET"; //HTTP request method preSignatureStruct.isHttps = true; //Generates an HTTPS request URL preSignatureStruct.signDurationSecond = 600; //Request signature validity period is 600 seconds preSignatureStruct.signHost = true; // Includes Host in the request signature. We recommend that you enable this to effectively prevent unauthorized requests. Note that after enabling, the actual request must also carry the Host request header. preSignatureStruct.headers = null; //Headers to be validated in the signature preSignatureStruct.queryParameters = null; //Query parameters in the URL to be validated in the signature string requestSignURL = cosXml.GenerateSignURL(preSignatureStruct); Console.WriteLine("requestUrl is:" + requestSignURL); //Downloads the request pre-signed URL (signature URL calculated using permanent key method) string localDir = System.IO.Path.GetTempPath(); //Local directory string localFileName = "my-local-temp-file"; //Specifies the local filename to save GetObjectRequest request = new GetObjectRequest(null, null, localDir, localFileName); //Sets the download request pre-signed URL request.RequestURLWithSign = requestSignURL; //Sets the progress callback request.SetCosProgressCallback(delegate(long completed, long total) { Console.WriteLine(String.Format("progress = {0:##.##}%", completed * 100.0 / total)); }); //Executes the request GetObjectResult result = cosXml.GetObject(request); //Request succeeded Console.WriteLine(result.GetResultInfo()); } catch (COSXML.CosException.CosClientException clientEx) { Console.WriteLine("CosClientException: " + clientEx); } catch (COSXML.CosException.CosServerException serverEx) { Console.WriteLine("CosServerException: " + serverEx.GetInfo()); } }
Generating a Pre-signed URL with Request Parameters in the Signature
public void GetPreSignUrlWithReqParam() { try { PreSignatureStruct preSignatureStruct = new PreSignatureStruct(); // For APPID, refer to https://console.cloud.tencent.com/developer preSignatureStruct.appid = "1250000000"; // Bucket region. For COS region abbreviations, refer to https://cloud.tencent.com/document/product/436/6224 preSignatureStruct.region = "COS_REGION"; // Bucket name. The format must be bucketname-APPID. For APPID, refer to https://console.cloud.tencent.com/developer preSignatureStruct.bucket = "examplebucket-1250000000"; preSignatureStruct.key = "exampleobject"; //Object key preSignatureStruct.httpMethod = "GET"; //HTTP request method preSignatureStruct.isHttps = true; //Generates an HTTPS request URL preSignatureStruct.signDurationSecond = 600; //Request signature validity period is 600 seconds preSignatureStruct.signHost = true; // Includes Host in the request signature. We recommend that you enable this to effectively prevent unauthorized requests. Note that after enabling, the actual request must also carry the Host request header. preSignatureStruct.headers = null; //Headers to be validated in the signature string ci_params = "imageMogr2/thumbnail/!50p"; preSignatureStruct.queryParameters = new Dictionary<string, string>(); // Query parameters in the URL to be validated in the signature, using Tencent Cloud Image Processing as an example preSignatureStruct.queryParameters.Add(ci_params, null); string requestSignURL = cosXml.GenerateSignURL(preSignatureStruct); Console.WriteLine("requestUrl is:" + requestSignURL); //Downloads the request pre-signed URL (signature URL calculated using permanent key method) string localDir = System.IO.Path.GetTempPath(); //Local directory string localFileName = "my-local-temp-file"; //Specifies the local filename to save GetObjectRequest request = new GetObjectRequest(null, null, localDir, localFileName); //Sets the download request pre-signed URL request.RequestURLWithSign = requestSignURL; //Sets the progress callback request.SetCosProgressCallback(delegate(long completed, long total) { Console.WriteLine(String.Format("progress = {0:##.##}%", completed * 100.0 / total)); }); //Executes the request GetObjectResult result = cosXml.GetObject(request); //Request succeeded Console.WriteLine(result.GetResultInfo()); } catch (COSXML.CosException.CosClientException clientEx) { Console.WriteLine("CosClientException: " + clientEx); } catch (COSXML.CosException.CosServerException serverEx) { Console.WriteLine("CosServerException: " + serverEx.GetInfo()); } }